Overview

overview

10

Static

static

3

a778965713...9N.exe

windows7-x64

10

a778965713...9N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a77896571383e76d76afd8d8a4f90d9bc945a6dcc44df65c55fbb3ab908b1fb9N.exe

  • Size

    78KB

  • Sample

    240925-rjwy3stajh

  • MD5

    e99f549224132b857af1f74e63f3e8d0

  • SHA1

    057c9d28c82bd2bf8090088d0f3aabec0e842363

  • SHA256

    a77896571383e76d76afd8d8a4f90d9bc945a6dcc44df65c55fbb3ab908b1fb9

  • SHA512

    6ab15771d710e1affc83b24b0398c986f9af13585216dd8afbacceb26e53042d3def4f63dda2b971eeb8e943a6cc15aad14a073b97a420b6938949bd9b7c7747

  • SSDEEP

    1536:cRWV5rXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6+9/U1+o:cRWV5rSyRxvhTzXPvCbW2U29/2

Score
10/10
metamorpherratdiscoverypersistenceratstealertrojan

Malware Config

Targets

    • Target

      a77896571383e76d76afd8d8a4f90d9bc945a6dcc44df65c55fbb3ab908b1fb9N.exe

    • Size

      78KB

    • MD5

      e99f549224132b857af1f74e63f3e8d0

    • SHA1

      057c9d28c82bd2bf8090088d0f3aabec0e842363

    • SHA256

      a77896571383e76d76afd8d8a4f90d9bc945a6dcc44df65c55fbb3ab908b1fb9

    • SHA512

      6ab15771d710e1affc83b24b0398c986f9af13585216dd8afbacceb26e53042d3def4f63dda2b971eeb8e943a6cc15aad14a073b97a420b6938949bd9b7c7747

    • SSDEEP

      1536:cRWV5rXT0XRhyRjVf3hTzdEzcEGvCZ1Hc5RPuoYciQtC6+9/U1+o:cRWV5rSyRxvhTzXPvCbW2U29/2

    Score
    10/10
    metamorpherratdiscoverypersistenceratstealertrojan

    • MetamorpherRAT

      Metamorpherrat is a hacking tool that has been around for a while since 2013.

      trojanratstealermetamorpherrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks